CVE-2026-110948: Download Manager (Free & Pro) - Unauthenticated Protected File Download via Media Preview Download Key

Q: Who is exposed to this issue?

Sites using the affected Download Manager plugin versions are exposed when a protected package can be reached through a public page that uses a media-preview renderer. Both password-locked files and files restricted by user role may be downloadable by unauthenticated visitors.

Q: What does an attacker need to exploit it?

An attacker needs access to a public page from which the media-preview renderer issues a download key for the protected package. No authentication is required.

Q: How can I tell whether protected files may already be accessible?

Review public pages that display media previews for Download Manager packages, especially packages configured with password or role restrictions. If a download key for a protected package can be obtained from such a page without logging in, the package is affected.

Q: What should be prioritized for remediation?

Update the plugin to a version that is not before 3.3.73 or not before 7.6.2, as applicable to the installed release line. Until updating, avoid exposing protected packages through public media-preview pages.

Published Nov 11, 2026

Updated

The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify that a visitor is allowed to access a package before its media-preview renderers issue a download key for it, allowing unauthenticated visitors to download password-locked and role-restricted files by reading the key from a public page.

Affected Software

1 affected component

W3 Eden Download Manager<3.3.73, <7.6.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Download Manager WordPress plugin to a version that resolves this vulnerability.
Fixed in 3.3.73
Upgrade
Upgrade Download Manager WordPress plugin to a version that resolves this vulnerability.
Fixed in 7.6.2

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who is exposed to this issue?

Sites using the affected Download Manager plugin versions are exposed when a protected package can be reached through a public page that uses a media-preview renderer. Both password-locked files and files restricted by user role may be downloadable by unauthenticated visitors.

What does an attacker need to exploit it?

An attacker needs access to a public page from which the media-preview renderer issues a download key for the protected package. No authentication is required.

How can I tell whether protected files may already be accessible?

Review public pages that display media previews for Download Manager packages, especially packages configured with password or role restrictions. If a download key for a protected package can be obtained from such a page without logging in, the package is affected.

What should be prioritized for remediation?

Update the plugin to a version that is not before 3.3.73 or not before 7.6.2, as applicable to the installed release line. Until updating, avoid exposing protected packages through public media-preview pages.

CVE-2026-110948: Download Manager (Free & Pro) - Unauthenticated Protected File Download via Media Preview Download Key

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether protected files may already be accessible?

What should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether protected files may already be accessible?

What should be prioritized for remediation?